Crypto securities register: who may keep it and what applies?

Short answer

The registrar of a crypto securities register is the entity the issuer designates as such vis-à-vis the holder; without a designation, the issuer itself is deemed the registrar (Section 16(2) eWpG). Crypto securities register keeping is a financial service that generally requires BaFin authorisation under Section 32(1) in conjunction with Section 1(1a) sentence 2 no. 8 of the German Banking Act (KWG); exceptions exist, among others, under Section 32(1f) KWG. Initial capital must be at least EUR 150,000 (Section 33(1) sentence 1 no. 1(b) KWG; BaFin Guidance Notice 02/2022, as of 14 February 2025). The registrar's ongoing duties follow, among others, from Sections 5, 7, 10, 16 to 19 and 25(3) eWpG and from the Electronic Securities Register Ordinance (eWpRV).

At a glance

Legal basis: Sections 16 to 23 eWpG; detailed rules in the eWpRV of 24 October 2022 (Federal Law Gazette I p. 1882).
Licensing requirement: generally Section 32(1) in conjunction with Section 1(1a) sentence 2 no. 8 KWG (crypto securities register keeping); exceptions, among others, under Section 32(1f) KWG.
Initial capital: at least EUR 150,000 (Section 33(1) sentence 1 no. 1(b) KWG; BaFin Guidance Notice 02/2022).
Section 20 eWpG (notification to BaFin and list of crypto securities) was deleted by Art. 26 no. 1 of the Location Promotion Act (Standortfördergesetz) of 4 February 2026 with effect from 10 February 2026.
Fines for breaches of register duties: up to EUR 100,000 (Section 31(3) eWpG).

Who is the registrar of a crypto securities register?

A crypto securities register must be kept on a tamper-proof recording system in which data is logged chronologically and stored protected against unauthorised deletion and subsequent alteration (Section 16(1) eWpG). A recording system is a decentralised arrangement with a predetermined distribution of control rights (Section 4(11) eWpG). In practice, these are blockchain or other distributed ledger systems.

The registrar is the entity designated as such by the issuer vis-à-vis the holder (Section 16(2) sentence 1 eWpG). If no designation is made, the issuer is deemed the registrar (Section 16(2) sentence 2 eWpG). The issuer may change the registrar without the holders' consent unless the terms and conditions or, for shares, the articles of association provide otherwise (Section 16(2) sentence 3 eWpG).

A special rule applies to crypto fund units: the registrar is the depositary or a company commissioned by it that holds a licence for crypto securities register keeping (Section 3 KryptoFAV). These units belong to investment funds managed by a capital management company (KVG).

What licence does a registrar need?

Keeping a crypto securities register under Section 16 eWpG is a financial service under Section 1(1a) sentence 2 no. 8 KWG. Anyone wishing to provide it in Germany commercially or on a scale requiring a commercial business organisation generally needs written or electronic authorisation from BaFin under Section 32(1) KWG; exceptions exist, among others, under Section 32(1f) KWG. For investment firms authorised under Section 15 WpIG, crypto securities register keeping is an ancillary business under Section 2(4) no. 4 of the German Investment Firm Act (WpIG).

BaFin has detailed the licensing procedure in Guidance Notice 02/2022 (BA), current version of 14 February 2025. Accordingly, initial capital of at least EUR 150,000 is required (Section 33(1) sentence 1 no. 1(b) KWG). For a company that conducts register keeping exclusively, BaFin generally considers one managing director sufficient and attaches particular importance to that person's technical expertise; depending on the size of the company, however, a four-eyes principle may be required. The application includes, among other things, a business plan for three financial years, an IT strategy and documents on the reliability and professional suitability of the managing directors.

Business organisation: BaFin refers to Sections 25a and 25b KWG and the MaRisk. According to BaFin, registrars without an authorisation under MiCAR are subject to the BAIT until 31 December 2026 and to DORA from 1 January 2027.
Publication: BaFin arranges for the licence to be published in the Federal Gazette and lists the institution in its company database.
European passport: according to BaFin, a company cannot act as a crypto securities registrar in other EEA states on the basis of the KWG licence. According to BaFin, a European passport is possible with an authorisation as a crypto-asset service provider.

What duties does the registrar have?

The registrar's duties follow from the eWpG and from the Ordinance on Requirements for Electronic Securities Registers (eWpRV). Breaches of key duties are administrative offences and can be punished with a fine of up to EUR 100,000 (Section 31(2) and (3) eWpG).

Duty	Content	Provision
Register details	Essential content of the right with identification number and designation as a security, issue volume, nominal amount or number of shares, issuer, individual or collective entry, holder, mixed holdings, additional details for shares	Section 17(1) eWpG
Individual entry	In addition, restrictions on disposal and third-party rights; holder must be identified by a unique identifier	Section 17(2) eWpG
Integrity and accuracy	Confidentiality, integrity, authenticity; register always reflects the legal position; total volume remains unchanged; liability for damages	Section 7 eWpG, Section 5 eWpRV
Instructions and re-registrations	Changes only on instruction of the holder or another authorised person or body, in order of receipt, time-stamped; re-registrations unambiguous and irreversible	Section 18(1) to (4) eWpG
Reversal	Reverse changes made without instruction without delay; content remains ascertainable	Section 18(5) eWpG, Section 15 eWpRV
Register extract	For individual entries, on request in text form, where necessary for the holder to exercise its rights; for consumers after entry, on every change and once a year	Section 19 eWpG
Inspection and register secrecy	Inspection for participants and where there is a legitimate interest; logging; log entries deleted after two years	Section 10 eWpG
Documentation	Document register, consensus mechanism, interfaces and register change; retention for ten years after the register ends	Sections 3, 13, 20, 21 eWpRV
Source code and interfaces	Source code including smart contracts on BaFin's request; export and retrieval interface	Sections 14, 19 eWpRV
Participation criteria	Fair, open, transparent, non-discriminatory; respond to applications within three months; complaint to BaFin possible if access is refused	Section 18 eWpRV

The former duty to notify BaFin of the entry of a crypto security and the statutory list of crypto securities (Section 20 eWpG) have been repealed. Section 20 eWpG was deleted by Art. 26 no. 1 of the Location Promotion Act (Standortfördergesetz) of 4 February 2026 (Federal Law Gazette 2026 I No. 33), in force since 10 February 2026 (Art. 64(1) of that Act); the current statutory text shows Section 20 eWpG as repealed. The duty to deposit the terms and conditions before entry continues to apply (Section 5 eWpG, Section 4 eWpRV).

Which duties remain with the issuer?

The issuer must take the technical and organisational measures needed to ensure the integrity and authenticity of the crypto securities for the entire duration of the entry (Section 21(1) sentence 1 eWpG). The issuer is liable for damage caused by the registrar only if it failed to exercise due care when selecting the registrar; liability is also excluded if the damage would have occurred even if such care had been exercised (Section 21(1) sentence 2 eWpG). Selecting the registrar is therefore a decision with liability implications.

If compliance with the register requirements is no longer ensured, the issuer must remedy the situation within a reasonable time; otherwise BaFin may require the transfer to another electronic securities register (Section 21(2) eWpG). A voluntary change of register requires the consent of all holders or of BaFin (Section 22 eWpG). Holders of bonds may terminate for cause if a deadline set to restore functionality expires without success (Section 30 eWpG).

What distinguishes a custodian from a registrar?

Register keeping and custody are legally separate. Register keeping as such does not constitute custody within the meaning of the Securities Deposit Act (Section 7(4) eWpG). The registrar records the legal position; the custodian holds securities or cryptographic keys for investors.

Role	Task	Licensing basis
Registrar	Keeps the crypto securities register, makes entries and re-registrations	Section 1(1a) sentence 2 no. 8 KWG
Custodian for collective entry	Is entered as holder and administers the collective entry on trust for the entitled persons	Safe custody business (Section 1(1) sentence 2 no. 5 KWG; Sections 4(6), 8, 9 eWpG)
Crypto custodian	Safeguards private cryptographic keys used to dispose of crypto securities	Qualified crypto custody business (Section 1(1a) sentence 2 no. 6(b) KWG)

With an individual entry, the investor is entered as holder (Section 8(1) no. 2 eWpG). With a collective entry, a central securities depository or custodian is entered, and investors are co-owners in fractional shares (Section 9(1) and (2) eWpG). The registrar determines which type of entry a register technically supports (Section 6 eWpRV).

How do issuers select a registrar?

Because the issuer is liable for selection errors under Section 21(1) sentence 2 eWpG, the selection should be documented and based on verifiable criteria. The following checkpoints derive from the eWpG, eWpRV and KWG.

Licence: does the entity hold a BaFin licence for crypto securities register keeping? This can be checked in BaFin's company database.
Recording system: which distributed ledger system and consensus mechanism are used, and from when are re-registrations final (Section 21(1) no. 5 eWpRV)?
Instruments: does the register support your type of security, for example bonds or registered shares with the additional details under Section 17(1) no. 8 eWpG?
Types of entry: individual entry, collective entry or both (Section 6 eWpRV)?
Exit capability: is a change of register technically prepared and documented (Section 20 eWpRV)?
Investor processes: how are register extracts under Section 19 eWpG provided and instructions authenticated (Section 11 eWpRV)?
Interfaces: are there export and retrieval interfaces in common formats (Section 19 eWpRV) for the custodian, paying agent and reporting?
Custody: which licensed custodian does the register work with?

How does heartstocks work with register and custody?

heartstocks GmbH, based in Hamburg, is a B2B partner for the digital issuance and settlement of tokenised securities under the eWpG, KAGB and AktG. According to its own figures (as of 2026), heartstocks has supported more than 15 tokenisation projects since 2021 and structured more than EUR 200 million in volume. In its seven-step process, technical implementation follows structuring, documentation and regulatory filing.

Instead of building their own register with a KWG licence, issuers working with heartstocks use the Nyala register. At heartstocks, the tokens are issued in the Nyala register; heartstocks coordinates register keeping together with regulated partners, and custody is provided via Tangany. Every transaction, every change of holder and every distribution is documented in the eWpG register.

At heartstocks, the regulated roles are connected: heartstocks provides investment brokerage as a tied agent of CONCEDUS GmbH, and register keeping and custody run via the partners named above. heartstocks bears the regulatory framework for platform and structuring.

For investors in issuances with heartstocks: their holding is entered in the eWpG register and visible in the investor dashboard, custody is provided via licensed crypto custodians with BaFin authorisation, and no own wallet is required. Regardless of the technology, investors bear issuer risk up to total loss as well as liquidity risk.

This article provides general information on the legal situation and does not replace individual legal or investment advice.

More at heartstocks: Project process for issuers White-label platform with register keeping Register and custody from the investor's perspective

Frequently asked questions

Does a crypto securities registrar need a BaFin licence?

As a rule, yes. Crypto securities register keeping is a financial service under Section 1(1a) sentence 2 no. 8 KWG and generally requires authorisation under Section 32(1) KWG; exceptions exist, among others, under Section 32(1f) KWG. Initial capital must be at least EUR 150,000 (Section 33(1) sentence 1 no. 1(b) KWG; BaFin Guidance Notice 02/2022).

Must a crypto securities issuance still be notified to BaFin?

The statutory notification duty under Section 20 eWpG has been repealed; the section is shown as repealed in the current statutory text. Other duties remain, such as depositing the terms and conditions (Section 5 eWpG) and, where applicable, prospectus or information sheet requirements.

Is the issuer liable for the registrar's errors?

In principle, the registrar itself is liable to the entitled person (Section 7(2) and (3) eWpG). The issuer is liable only if it failed to exercise due care in selecting the registrar and the damage would not have occurred with careful selection (Section 21(1) sentence 2 eWpG).

Is the registrar also the custodian?

Not automatically. Under Section 7(4) eWpG, register keeping is not custody within the meaning of the Securities Deposit Act. Safeguarding private keys for crypto securities requires its own licence as qualified crypto custody business (Section 1(1a) sentence 2 no. 6 KWG).

Can the registrar be changed?

Yes. The issuer may change the registrar without the holders' consent if the terms and conditions or the articles of association do not provide otherwise (Section 16(2) sentence 3 eWpG). Moving to another register, however, requires the consent of all holders or of BaFin (Section 22 eWpG).